Glorious Factions — Privacy Policy

Draft — for legal review

Last updated: [DATE]

In short: Ananta Studios runs Glorious Factions and decides how your data is used. We collect what we need to run your account and the game: your email, username and game progress, the messages you write, records of your purchases, and some security records to fight cheating and abuse. We do not use analytics, advertising, tracking cookies or third-party fonts, and we do not sell your data. Some of your game profile is visible to other players, because that is how a multiplayer game works. You can download your data or delete your account from the Account panel in the game, or by emailing us.

Related documents: Terms of Service · Purchase Terms · Game Rules · Cookie and Local Storage Notice · Legal Notice

Contents

1. Who we are
2. What this policy covers
3. The data we collect
4. What we do not collect
5. How we use your data and our legal bases
6. What other players can see
7. Computer-controlled players
8. Who we share data with
9. International transfers
10. How long we keep data
11. How we protect data
12. Your rights
13. Additional information for players in the United States
14. Automated decisions
15. Children
16. Changes to this policy
17. Contact us
18. Notes for counsel (remove before publication)

1. Who we are

1.1 Glorious Factions (the "game") is operated by Ananta Studios, a subsidiary of RLM Global ("we", "us", "our").

1.2 Ananta Studios is the controller of your personal data. This means we decide why and how it is processed, and we are responsible for it.

1.3 Representatives. Because we are based in the United States, we have appointed representatives for privacy matters:

• EU representative (GDPR Article 27): [EU REPRESENTATIVE — name, address, email]
• UK representative (UK GDPR Article 27): [UK REPRESENTATIVE — name, address, email]
• EU Digital Services Act legal representative: [DSA LEGAL REPRESENTATIVE]

You can contact a representative instead of us if you are in their region.

1.4 Data Protection Officer. [PLACEHOLDER: We have not appointed a Data Protection Officer because the law does not require one for our activities. / Our Data Protection Officer is [NAME], [EMAIL].]

2. What this policy covers

2.1 This policy covers personal data we process when you visit our website, create an account, play the game, buy premium items, use optional features, or contact support.

2.2 It does not cover third-party websites you choose to visit. Those sites have their own policies. Stripe's payment page is covered in section 8.

3. The data we collect

We collect data you give us, data created when you play, and a small amount of technical data needed for security.

3.1 Account data

• Email address.
• Password. Our authentication provider stores it only in hashed form. We cannot see your password.
• Username, display or ruler name, and alias.
• Referral code you used when signing up, if any.
• The date your account was created.
• The time you were last active. We record this when the game loads.
• Your confirmation that you are 16 or older and that you accept the Terms and this policy.

3.2 Game data

Playing the game creates records such as:

• cities, buildings, troops, resources, research and titles;
• alliances, alliance roles and alliance membership;
• marches, combat reports, trade and market activity;
• quests, daily login records and referral relationships;
• account sitting ("substitution") records, including an audit log of what a sitter did on your behalf;
• your notification preferences.

3.3 Communications

• Chat messages you send in world, alliance or private chat.
• In-game mail you send and receive.
• Alliance forum and board posts.
• Notifications the game sends you (for example attack warnings or completed builds).

Moderators can hide (soft-delete) messages and review chat history when they handle reports or enforce the Game Rules.

3.4 Purchases

When you buy Sidereals, payment happens on Stripe's checkout page. The packs are sold through Stripe's Link service, which is the seller ("merchant of record"): your payment details go directly to Stripe and Link, and they calculate and pay the tax, send your receipt and handle payment questions, refunds of payments and disputes. We never receive or store your full card number.

From Stripe we receive and keep a record of the payment event. Depending on the payment, this can include:

• your email address, name and billing country or address;
• Stripe's checkout and payment identifiers;
• what you bought, the price, and your player ID.

We also keep records of how you spend Sidereals in the game (for example shop items and Advisor plans). See the Purchase Terms.

3.5 Push notifications (optional)

If you turn on browser alerts, we store:

• the push "endpoint" and encryption keys your browser gives us;
• your browser's user-agent string, shortened to at most 200 characters, so you can recognise your devices;
• which alerts you want to receive.

You can turn alerts off in the game or in your browser at any time.

3.6 Support and reports

• Support tickets and the messages in them, including "Report a player" reports.
• Notes our staff add internally while handling a ticket.
• Logs of actions our staff take (for example a mute, suspension or refund).
• Sanctions. Our staff can suspend an account for a set time, or ban it for a set time or permanently, when it breaks the Terms of Service or the Game Rules. While a sanction lasts, the account cannot take actions in the game. For each sanction we record its kind, the reason staff gave, its start and end dates, which staff member applied it and, if it is lifted early, when, by whom and why. Your own sanctions are part of your data download (section 12), and you can appeal them (section 14.5).

3.7 Security and anti-abuse data

• Login history. When you load the game, the server records the time, your browser's identification string (its "user agent", shortened to at most 200 characters) and the version of the game you are running, at most once an hour. It does not record your IP address. Staff use it to help with support requests, to protect accounts that may have been taken over, and when they investigate multi-accounting or other breaches of the rules. It is part of your data download (section 12). Kept 30 days.
• Action log. A log of actions you take in the game, used to investigate bugs, cheating and disputes.
• Economic flows between players. The game records transfers of value between accounts (for example trades and shipments). Staff review these, and any automatic flags they raise, to detect multi-accounting and "pushing" (one account unfairly feeding another).
• Action limits and activity pattern. The server counts the game actions your account sends, per minute and per hour, to stop scripts that flood the game. It keeps hourly totals (how many actions, and in how many minutes of the hour you acted) for 14 days. The live counters are kept for 2 days at most.
• Connection identifiers. To spot accounts that are run from the same connection or device (see Game Rules 1 and 2), the server stores a keyed hash of the internet address you play from (for IPv6, of the network part, the first half of the address) and a keyed hash of your browser's identification string, with when each was first and last seen. The key is secret and held only on our server. We do not store the address or the browser string itself, and the hash cannot be turned back into either. Kept 30 days.
• Device and browser identifiers. The game keeps a random device identifier in your browser's storage (see the Cookie and Local Storage Notice). With each game request it also sends a hash of some traits of your browser and computer: graphics hardware, screen size, time zone, languages and number of processor cores. The server stores only keyed hashes of these, with when they were first and last seen, for 30 days. We use them to spot one person running several accounts, and to keep banned players from coming back (see below).
• Ban records. When an account is banned for breaking the Game Rules, we keep keyed hashes of the identifiers it used for as long as the ban lasts:
• its device identifiers;
• its browser traits together with its connections;
• its connections;
• its email address, normalised (lower case, without "+" tags, and for Gmail without dots).

New accounts that use them are banned automatically, and sign-ups with that email address are refused (Game Rules 14.7). We keep these records even if the banned account is deleted, until the ban ends or is lifted, because otherwise a banned player could delete the account and sign up again. When a ban is lifted, they are deleted.

• Throwaway email addresses. Sign-up is refused for known disposable-email services. We keep a list of their domains, not of any person.
• Sign-in rate limiting. When you sign in with your username instead of your email, we limit repeated attempts. To do this we store a SHA-256 hash of your IP address, not the IP address itself, for no more than one hour.
• Provider access logs. Our hosting and authentication providers keep their own technical access logs (which can include IP addresses) to run and protect their services. See section 8.

3.8 Data stored on your device

The game keeps your sign-in session and your game preferences in your browser's local storage. We do not use cookies. Details are in the Cookie and Local Storage Notice.

4. What we do not collect

4.1 We keep data collection deliberately small. We do not:

• use analytics or usage-tracking services;
• show advertising or use advertising networks;
• set tracking cookies, or any cookies at all;
• load fonts or other resources from third-party font services;
• build profiles of you for marketing;
• sell your personal data, or share it for cross-context behavioural advertising.

4.2 If we ever want to change this, we will update this policy first and ask for your consent where the law requires it.

5. How we use your data and our legal bases

5.1 If you are in the EU, EEA, UK or Switzerland, we must have a legal basis for each use of your data. The table below shows what we do and why.

5.2 Legitimate interests. Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details of that assessment, and you have the right to object (section 12).

5.3 What happens if you don't give us data. We need your email, password and username to create an account. Without them we cannot provide the game. Push notifications are optional.

5.4 Marketing. We do not send marketing emails. [PLACEHOLDER: If we add a newsletter later, we will ask for your consent first.]

6. What other players can see

6.1 Glorious Factions is a multiplayer game. To play with others, some information is visible to other players:

• your username and display or ruler name;
• your alliance and title;
• your cities (names, positions on the map and sizes) and your rankings;
• combat reports you choose to share;
• the chat messages and forum posts you write (visible to the people in that channel, alliance or conversation);
• mail you send (visible to its recipients);
• if your account is suspended or banned for breaking the Game Rules: your account name, the kind of sanction, a reason category and the dates, in the in-game pillory (Game Rules 14.8). The details of the case are never shown.

6.2 Other players cannot see your email address, password, purchase history or security records.

6.3 Please do not put personal information, such as your real name, in your username, city names or public messages.

6.4 If you share information in the game (for example in chat), the people who see it may copy or remember it. Deleting it from the game cannot undo that.

7. Computer-controlled players

7.1 Some worlds include computer-controlled rivals that play by the same rules as human players. The Terms of Service explain how they work.

7.2 Computer-controlled players process only game state: the same map, city, alliance and combat information that any player can see in the game. They do not read your private profile fields, your email address, your payment data or your security records. They use rule-based behaviour, not generative AI, and they are not used to profile you.

7.3 If a computer-controlled player sends you mail, joins your alliance or attacks you, that interaction is stored as ordinary game data.

8. Who we share data with

8.1 Service providers (processors). We use a small number of providers who process data on our behalf, under contract, and only for the purposes we set:

8.2 Stripe and Link. Sidereal packs are sold through Stripe Managed Payments, with Stripe's Link service as the seller. As the seller, Stripe/Link is an independent controller of the data it collects at checkout and afterwards (payment details, billing address for tax, receipts, refund and dispute handling, fraud prevention and its legal obligations); Link's and Stripe's privacy policies explain that use: [LINK / STRIPE PRIVACY POLICY LINKS]. Stripe tells us about each payment, refund and dispute so that we can deliver or remove the Sidereals. If you ask Link to delete your data, Stripe also deletes it from the payment records in our Stripe account.

8.3 cotgopt.com, our city planner (optional feature, only if you use it). The game can import a city layout from cotgopt.com, a city planner site we also run. If you use the feature, your browser connects to cotgopt.com directly with the name or link you enter, so that site receives your IP address and what you entered, and uses them only to return the layout. No other game data goes to it. If you never use the feature, no data goes there.

8.4 Within our group and in business transfers. We may share data with RLM Global and its other subsidiaries where needed to run, support or administer the game. If all or part of our business is reorganised, merged, or sold, personal data may be transferred to the new owner, who must continue to protect it in line with this policy. We will tell you before your data becomes subject to a different privacy policy.

8.5 Authorities and legal reasons. We may disclose data where we are legally required to (for example a valid court order), or where it is necessary to protect the rights, property or safety of our players, staff or the public, to enforce our terms, or to investigate fraud or security problems.

8.6 Other players. See section 6.

8.7 We do not sell personal data and we do not share it with advertisers or data brokers.

9. International transfers

9.1 Our game data is stored in [SUPABASE REGION]. Ananta Studios is based in the United States, and our staff and some providers process data in the United States.

9.2 If you are in the EU, EEA, UK or Switzerland, this means your data is transferred outside your region. Where a transfer goes to a country without an adequacy decision, we protect it with one or more of these safeguards:

• the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum where relevant;
• the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), where the recipient is certified [CONFIRM WHICH PROVIDERS ARE CERTIFIED];
• other safeguards permitted by law.

9.3 You can ask us for a copy of the relevant safeguards by emailing legal@gloriousfactions.com.

10. How long we keep data

10.1 We keep data only as long as we need it. Many records are deleted automatically.

10.2 Abandoned empires are different from deleted accounts. If you are inactive in a world for 30 days (20 days below the Thane title), your empire in that world is abandoned under the game rules. That does not delete your account. Your cities become abandoned cities in that world.

10.3 Deleted accounts. When you delete your account (section 12.3):

• we delete your account and personal data;
• we keep purchase records only in anonymised form for tax and accounting;
• we keep moderation records only in anonymised form, so that we can show how rules were enforced;
• abandoned cities may remain in the world, without your name;
• the mail you sent and received, your chat messages and your forum and board posts are deleted with the account;
• other players may still have copies of things you shared outside the game, or remember what you wrote.

You can cancel a deletion request during the 7-day grace period; until then your account plays on normally. Deletion runs automatically once the grace period ends.

10.4 We may keep specific data longer if we need it to deal with a legal claim, a dispute or an investigation, or if the law requires it. We delete it when that need ends.

11. How we protect data

11.1 We use technical and organisational measures appropriate to the risk, including:

• encrypted connections (HTTPS) between your browser and our services;
• passwords stored only as hashes by our authentication provider;
• database access rules (row-level security) so that each player can read only what they are allowed to, and all game actions validated on the server;
• staff access limited to people who need it, with staff actions logged;
• storing hashes of your IP address instead of the address itself, for rate limiting and fair play (the fair-play hashes use a secret key held only on our server);
• encrypted backups of the database, stored at [BACKUP LOCATION];
• payment card details handled only by Stripe.

11.2 No system is perfectly secure. If a breach affects your data and the law requires it, we will notify you and the relevant authority.

11.3 You help too: use a strong password that you don't use anywhere else, and never share your password. Account sitting is available through the in-game substitution feature, so you never need to give anyone your password.

12. Your rights

12.1 Your rights under the GDPR and UK GDPR

If you are in the EU, EEA, UK or Switzerland, you have the right to:

1. Access — get a copy of your personal data and information about how we use it.
2. Rectification — have inaccurate data corrected.
3. Erasure — have your data deleted, unless we must keep it (for example for tax).
4. Restriction — ask us to limit how we use your data in certain cases.
5. Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another provider where technically possible.
6. Object — object to processing based on legitimate interests. We will stop unless we have compelling reasons that override your interests, or we need the data for legal claims.
7. Withdraw consent — where we rely on consent (push notifications), you can withdraw it at any time. This does not affect processing that already took place.
8. Not be subject to solely automated decisions with legal or similarly significant effects (see section 14).
9. Complain to a supervisory authority — in the country where you live or work, or where you think an infringement happened. In the UK this is the Information Commissioner's Office (ICO). We would appreciate the chance to resolve your concern first, but you don't have to contact us before complaining.

12.2 How to exercise your rights

• In the game: open the Account panel and use "Download my data" to receive a copy of your data, or "Delete my account" to delete it.
• By email: write to legal@gloriousfactions.com from the email address on your account.
• Through a representative: see section 1.3.

We may need to confirm your identity before acting on a request, so that nobody else can get or delete your data. We will answer within one month. If a request is complex we may extend this by up to two more months and will tell you why. Requests are free unless they are clearly unfounded or excessive.

12.3 Deleting your account

When you choose "Delete my account", your account enters a 7-day grace period. During that time you can cancel by signing in again [PLACEHOLDER: confirm the cancellation mechanism]. After 7 days we delete your account as described in section 10.3. Deletion is permanent: your empires, Sidereals and items cannot be restored, and unused Sidereals are not refunded except as set out in the Purchase Terms or required by law.

12.4 Correcting your data

You can change some account details yourself in the game [PLACEHOLDER: list editable fields, such as display name and password]. For anything else, contact us.

13. Additional information for players in the United States

13.1 California Online Privacy Protection Act (CalOPPA). This policy describes the personal data we collect, how we use and share it, and how you can review and request changes to it (section 12). We will post any changes here with a new "Last updated" date.

13.2 Do Not Track. Some browsers send a "Do Not Track" signal. There is no common standard for how to respond to it. Because we do not track you across other websites or services, and do not allow third parties to do so through our game, our practices are the same whether or not your browser sends this signal. [PLACEHOLDER: state whether we honour Global Privacy Control signals; we have no sale or sharing to opt out of.]

13.3 State privacy rights. Depending on where you live (for example California, Colorado, Connecticut, Virginia or other states with consumer privacy laws), you may have the right to know what data we hold, to get a copy, to correct it, and to delete it. Even where a law may not apply to a business of our size, we honour these requests from any player. Use the methods in section 12.2. You can use an authorised agent; we may ask for proof of their authority and verify your identity. We will not treat you differently for exercising your rights. If we decline a request, you can appeal by replying to our decision or writing to legal@gloriousfactions.com.

13.4 No sale or sharing. We do not sell personal data, and we do not "share" it for cross-context behavioural advertising, as those terms are defined in California law. We have not done so in the past 12 months. We do not knowingly sell or share data of anyone under 16.

13.5 Categories of data (California summary). In the past 12 months we collected: identifiers (email, username, player ID, hashed IP address); commercial information (purchase records); internet or network activity (in-game action logs); and the content of messages you send in the game. We collected them from you and from your use of the game, for the purposes in section 5, and disclosed them only to the recipients in section 8. We do not use sensitive personal information to infer characteristics about you.

14. Automated decisions

14.1 The game raises automatic flags when it sees patterns that may indicate cheating, such as unusual transfers of value between accounts, play around the clock or at a machine-like pace, or accounts that share a connection and send each other resources. A flag is a prompt for review, not a decision. 14.2 Staff review flags before taking action against an account. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

14.3 Normal game mechanics (for example the result of a battle, or an empire being marked abandoned after the inactivity period) are rules of the game you agreed to, applied the same way to every player.

14.4 Action limits are automatic. If an account sends more game actions in a minute or an hour than a person can, the server refuses further actions until that minute or hour is over. This is a short technical pause, applied the same way to every account. It is not a sanction, and normal play never reaches the limit.

14.5 If you think a sanction against you is wrong, you can appeal through the in-game Support panel, as set out in the Game Rules.

15. Children

15.1 Glorious Factions is not intended for anyone under 16. You must confirm that you are 16 or older when you sign up.

15.2 We do not knowingly collect personal data from anyone under 16. If we learn that a player is under 16, we will delete the account and its personal data.

15.3 If you believe a child under 16 has an account, please tell us at legal@gloriousfactions.com.

16. Changes to this policy

16.1 We may update this policy when our game, our providers or the law changes. The "Last updated" date at the top shows when it last changed.

16.2 If we make a material change, we will tell you in advance by email or in the game. Where the law requires your consent to a change, we will ask for it.

17. Contact us

• Privacy questions and requests: legal@gloriousfactions.com
• Post: Ananta Studios, [ADDRESS]
• In the game: Support panel → new ticket
• EU representative: [EU REPRESENTATIVE]
• UK representative: [UK REPRESENTATIVE]

See also the Legal Notice.

18. Notes for counsel (remove before publication)

1. Art. 27 representatives. The operator is US-based and the game is offered to EU and UK players, so GDPR and UK GDPR Art. 27 representatives are likely required (the "occasional processing" exemption is unlikely to fit a persistent online game). Fill in section 1.3 and decide whether the DSA legal representative is required at our size and service type. Confirm whether a DPO is needed (section 1.4). Our assessment is no, because there is no large-scale systematic monitoring or special-category data, but the anti-cheat economic-flow review should be considered.
2. Supabase region and DPA. Confirm the Supabase project region ([SUPABASE REGION]) and that Supabase's DPA (including SCCs) has been accepted for the project. Confirm the email sender used by Supabase Auth (Supabase's built-in sender or a custom SMTP provider). If it is a custom provider, add it to section 8.1. Confirm Hostmonster's terms include data-processing commitments and SCCs, and what its access logs keep.
3. Stripe's role. With Managed Payments (owner 2026-10-09) Stripe/Link is the merchant of record, so the draft treats it as an independent controller for the sale. Confirm this against Stripe's Managed Payments terms and Link's privacy policy, and insert the links in section 8.2. Confirm which payment-event fields we actually keep (email, name, billing address) and minimise them if possible.
4. Retention placeholders. Decide: purchase records ([7] years is a placeholder; check Kansas and US federal rules plus EU VAT/OSS record-keeping, which is 10 years for OSS); support tickets; staff and moderation logs; substitution audit logs; longer-kept PvE kill records; game data after a world ends; forum posts; inactive-account deletion (with a reminder email); what happens to sent mail and posts on account deletion. Each needs a matching automatic job before the policy is published.
5. Backups. State the backup location, encryption method and retention. Backups currently hold player accounts. Deleted accounts persist in backups until they expire; the policy says so. Confirm that restores re-apply deletions made since the backup was taken.
6. CCPA thresholds. We believe the operator is below the CCPA/CPRA thresholds (US$25m+ annual revenue as adjusted; buying, selling or sharing personal information of 100,000+ consumers or households; or 50%+ of revenue from selling or sharing). The 100,000-consumer test may be reached by a successful game. Section 13 honours requests voluntarily. Re-check thresholds for other states (for example, some count consumers at lower numbers) and decide whether to formally recognise Global Privacy Control signals.
7. Features that must ship before publication. In-game "Download my data" and "Delete my account" (7-day grace period, section 12) are built (migration 269); they must be live in production before this policy is published, otherwise point only to the email route. Account deletion deletes mail sent and received, chat and forum posts; purchase records and payment/abuse tickets are kept unlinked from the player. A technical fix so that other players can no longer read private profile fields is half done (migration 268); section 6 describes the final state, so the second step must be deployed before publication.
8. Legitimate-interests assessments. Prepare short written LIAs for anti-cheat (action log and economic-flow review), moderation and security logging. Section 5.2 offers them on request.
9. Sign-up confirmation. The sign-up checkbox combines age confirmation and acceptance of the Terms and Privacy Policy. Under the GDPR, "accepting" a privacy policy is not a legal basis. Consider rewording it to "I have read the Privacy Policy" and keeping consent separate (push notifications only).
10. Push services. Notification content is encrypted end to end to the browser under the Web Push protocol. The push services see the endpoint and metadata. Confirm we keep notification text free of personal data beyond what is needed.
11. cotgopt.com. Owned by the operator (owner, 2026-10-12), so it is described as our own site rather than a third party. Confirm which entity operates it, whether this policy covers it or it needs its own notice, and add its hosting provider to section 8 if it keeps logs. The connection stays user-initiated; confirm the in-game feature says where it connects before it does.
12. Device identifier and browser traits (migration 318).

• What it does. The game stores a random identifier in local storage and sends a hash of browser and hardware traits with each request. The server keeps only keyed hashes.
• ePrivacy. Under the ePrivacy Directive (Art. 5(3)) and its national laws (for example the UK PECR), storing an identifier and reading device traits needs consent, unless it is strictly necessary for a service the user asked for. We rely on the security and fraud-prevention reading: enforcing bans, and stopping one person running several accounts.
• Confirm. Is that reading available in our target countries (EDPB Guidelines 2/2023 read the exemption narrowly)? Do we instead need a consent step, with a fallback for players who refuse?
• Ban records. We keep a banned account's hashed identifiers and normalised email after the account is deleted, for as long as the ban lasts. Confirm this as a legitimate-interests retention: it is an erasure exception for the establishment or defence of legal claims and the protection of other users.
• LIA. Add the ban-evasion processing to the LIA in note 8.

1. The pillory (migration 318). Publishing the name of a sanctioned account is itself a measure with effects on the player (DSA statement of reasons; reputation).

• Confirm the safeguards: a fixed reason category rather than free text; no staff names; time-limited listing; removal on appeal.
• Confirm that staff discretion is enough (the default is on for bans), or whether the Terms should make listing automatic for named categories only.

1. Login history and sanctions (migration 272).

• Login history. We keep the time, user agent and game version of each game load (at most hourly) for 30 days; no IP address. We rely on legitimate interests (account security, support, rule enforcement). Add it to the LIA in note 8.
• Sanctions. Staff can suspend (timed) or ban (timed or permanent) an account. The record holds the reason in free text written by staff, so staff guidance should keep reasons factual and free of unnecessary personal data. Confirm the DSA statement-of-reasons duties for suspensions and bans, and that the appeal route in section 14.5 meets them.